1. Field of the Invention
The present invention relates to a method for controlling a allowance or denial of an access request from a user in the case where the user attempts to access for a specific object such as a directory, device, and general file, etc. (i.e., all the objects of which names are given by a storage device) stored in a storage device, and more particularly to a file access control method using a token having security attributes in a computer system where the token and its attributes, which were assigned to a file when it was generated, is used for access decision of a user to a specific file.
2. Description of the Related Art
Typically, various kinds of file access control methods for security, such as a MAC (Mandatory Access Control) method, an DAC (Discretionary Access Control) method, and a RBAC (Role-Based Access Control) method, etc., have been widely used.
Firstly, a MLS (Multi Level Security) method being one of the MAC methods limits access to an object on the basis of confidentiality of information contained in an object and authority of a subject, and is defined as an information flow control policy because it protects information flow ranging from a high-grade object to a low-grade object. Two regulations for controlling such information flow are a No-Read-UP regulation for preventing a low-grade subject from reading a high-grade object, and a No-Write-Down regulation for preventing a high-grade subject from writing in a low-grade object. Therefore, information confidentiality is ensured using the No-Read-Up regulation, and illegal information flow is prevented using the No-Write-Down regulation.
However, the aforementioned MAC is compatible with access control policy requirements of the government or military facilities, but is not compatible with access control policy requirements of a commercial field. For example, in order to provide an outside user with readable/unwritable information, the outside user must have a higher grade than an inside user who produces this readable/unwritable information. In this case, there is a disadvantage in that the outside user has authority to read all information produced by the inside user.
Secondly, an ACL (Access Control List) method being one of DAC (Discretionary Access Control) policies, is extention of the UNIX permission method. By ACL, a user can assign more permission to particular user or group besides typical permissions related to a user, group, and other based on a typical UNIX operating system. However, the ACL method has the same disadvantages as a DAC method even though it can be more finely controlled.
Firstly, a control component in DAC attributes has no knowledge of meaning of data because it is wholly based on an identity of a subject. Secondly, since the control in DAC attributes determines access permission or access denial on the basis of an identity of a subject, it is ineffective in that access may be permitted using other person's identity instead of the subject's identity, and it is also ineffective to protect against Trojan horse problem.
Finally, the Role Based Access Control method determines user's access to information on the basis of an individual role (or duty) within a system, instead of an individual identity, and is an access control policy appropriate for access control requirements of commercial fields. The Role Based Access Control method has three kinds of basic factors, i.e., a user, a role, and permission. In the case where the Role Based Access Control method performs a real access control test using the three basic factors, a user can gain access to a corresponding file on condition that he or she belongs to constituent members having authority to access the corresponding file. The Role based Access Control method has an advantage in that it facilitates operation and security management of an overall system. For instance, since the Role Based Access Control method has a variety of roles such as a security management role, a system management role, and a Web management role, etc., it enables only a particular user belonging to a corresponding role to handle system security and operation management in such a way that authority of a root user can be divided into many roles. Also, the Role Based Access Control method need not change permissions of all files even though a manager is changed to a new manager, but needs to insert the new manager into constituent members of a corresponding role, thereby facilitating security management.
However, the Role Based Access Control method unavoidably contains several variable components which shall be changed according to application area, so that it has been used only for the limited application levels such as a database and a Work-Flow system, thereby limiting the number of available application fields.